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SUMMARY OF THE INVENTION 



* RYOF , -i^larly applicable W^ 1 ™ 
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invention comprises '^^^'""^.^^a.dval^ofproKc^^ 
vevvalue for UK l»«dle, modifying and deletrng key ^ 

lists and rejection lists. d ^ transmission system 

including registry monitoring, a machine 

DESCRIPTION OF THEDRAWINGS 
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1 musttativeembodimen. of to invention. 

S DETAILED DESCRIPTION OF THE INVENTION 

^andrnayredneeore^-^^^ * — 
20 restricting siting to a file system, transfemng 

An exemplary embodiment of .he regutfy m ^ ^ ^ ^ 

^.-i^-nM! to complete the requests oycu » 
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carried out on a computer imp«= 
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e-pUofs^a^-P-" P . ^receiver runs 

. a recipient computer <° *~ — » I- — *• » » " 

invention. A registry entry guard dnve 20 aonsl60 run on higher 

nHver ,40. Both drive, exist on the kerne! <™* °> ^ ^ 120 ta 

i *n r^nuest access to regisixy 
i -id Aft When applications 160 requests 
levels 14U. vvncnapp K a«Hle the requests. 

^on^hookdriver,— ^^^eornr.ndeenter which, 
Apackagecarriesdata and provrdes assoc.* A 
, .conrponentofanappUcattonprog^ng^ ^ te appSSn^o^ning — 

^nnication drive, handles «"^~ ^er l/O control functions 
, andaplurahtyofdevicedrivers. "^^"^^^info^on^ or retrieve 

O informatafromthedevtcednvers. The c»mm ffle ^ device drivers, 
S no^^e^dcenterurataprocesstst^ P^ ^ ^ . ^ 

S ^^^appU^ortprogranurong ^ Klecl i„, Thecommand 

™ payload. 

* intothevaul, "-^^^^.OewhenappUca^exi, The 
w ,™ am cka^ file- K»ay also not.fydev.ee . Mflie request of a 



pay.oau. . , = „i,hdialos indicating that an appucauv,.... r 

intothevaul, "-^^^^.OewhenappUca^exi, The 
open a packaged file. « may „ „ me ^es, of 

conunandcen^rnvayWockchpboardaccessan ^ tioMs stained 

permissions device driver when per— «^ fite sysKnl ro and file 

Uaseaudmayinchtdcforexampie ; f ^^.l.^ofuureornurnherof 

the future. w^iment of the invention. Those skilled in the 

FIGURES 2 A-C depict an illustrate embedment of th 
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WO 01/25953 mnnitorina system that include security checks 

a^wiUunderstand^^^ 

toblockaccesstokeys^^^^^ 

within the spirit and scope of the invention. FIGURE 2Adep 

• M „ The call is made to obtain a handle for a registry Key 
for a registry open key call. The call is m in step 304 a process ID and registry 

keyaredeteniuned. art-*. ^ fa opdattd .. 

rmm .m~~**>«*»*» 8 itlsdettmli nedwh e U 1 er to t«gis tt yke yl8 

initiated. Kthe process ,s vend, then » *«* ^ to ^ 

■ ^ k- Tf the reEistry key is on the rejection list, the process is a 
10 **J^JL«^^*-* S "- Iftheprocessisnoton 

registry key in step 310 and the ca „,„ nthe rejection list, then in step 3 14 the request 

the secured list or if the registry key name » not on the rejection 
O iscontple^andUtecallissuccessMyfil-dins^m ^ 
3 F.GUKE.Bisanmus^veflowch^forare^ md ^ key 

B A registry key value for die handle is request in step IfcTh P ^ 
S narnearedeterrninedins^lS. 

5 ae^nnincwheutereieprocessissecured. * ^ ^ ^ rejectio , Us.d.e 

U wheutertheregistrykeyisonareject.onhst. 1 te call is successfully filtered 

20 — "-"r^TS ^iXu.oton.erejecnonlista.duie 

process is on the secured process list, in Ifthe value is not on the 

25 filtered inblock 326. tfthe value is on the rejection istth 

registry ke, vahie, and the cal, is success^ fibred >£f™ flow char, for a 

d eletion or modification sequence is depict » F10OM 3CA 

tas tep334. ' f 

■ *• »— 18 " 0t ° D *" """l * orocess is on *. secured process list, the request is no. 
successfully filtered in step 342. Ifthe process is on 

, j ■ *44 and the call is successfully rilterea m •> 
allowed to be completed in step 344 and tne cai 
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7 ^n i.dudingwiftou.lim^caprccesaor.amic^rooessor, apersonal 
^^0^0,..,^^ desktoporworksta Uo n ,.«e W or kS e I v e r,a m a i n & a m e,an 
computer, such as a laptop, palm PC, desktop or ilMeract j V e television or 

„ me « a cellular telephone, a personal d.g.tal assistant, an 
„ , K, n ™mustraaveexamplemfonnaUonistrar^ttedinmeformofe.rmul. tm 

0 — "^J ^L— — * — 

wKiip the invention has been aescnoea oy muo 

Halations will occur to those UWI. - 1 Wore, the invent « » 
D adv^ugesandmodtflcat.or.wtl ddescribe<)herem . Modifications, for 

* m ve«uo„rK>.belimi^«>*"P-ifl- ll ^ veOT,X,toen,SbU ^ 
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